C2150-614 practice questions, page 3 of 3, with answer review and explanations.
Question 11
A Deployment Professional has a reference list of usernames that is used in rules. The Deployment Professional needs to be able to remove a username from the reference list when an offense is detected from a log event. How can a Deployment Professional accomplish this goal?
As a rule response, select update Reference Set option
As a rule response, select remove from Reference Set option
As a rule response, select execute custom action in order to call REST-API: UPDATE: /reference_data/sets/{name}
As a rule response, select execute custom action in order to call REST-API:
Question 12
A Deployment Professional has created a new Building Block (BB), and it's not returning any expected events. The Deployment Professional has checked to ensure the BB is enabled and active. No errors are returned. What should be done to correct this BB problem?
Add your new custom BB to the "System: Load Building Blocks" rule
Ensure that the BB has been set to "use" and a Deploy Full Configuration was done
Make sure that you use "Global System" so that all of the QRadar deployment uses it
Manually enter in all QID's of the events it till monitor so it will automatically be used